com.google.common.html.types

Class SafeUrl

java.lang.Object

com.google.common.html.types.SafeUrl

@Immutable
 @JsType
public final class SafeUrl
extends Object

A string that is safe to use in URL context in DOM APIs and HTML documents.

A SafeUrl is a string-like object that carries the security type contract that its value as a string will not cause untrusted script execution when evaluated as a hyperlink URL in a browser.

Values of this type are guaranteed to be safe to use in URL/hyperlink contexts, such as, assignment to URL-valued DOM properties, or interpolation into a HTML template in URL context (e.g., inside a href attribute), in the sense that the use will not result in a Cross-Site-Scripting vulnerability.

Note that this type's contract does not imply any guarantees regarding the resource the URL refers to. In particular, SafeUrls are not safe to use in a context where the referred-to resource is interpreted as trusted code, e.g., as the src of a script tag.

Field Summary

Fields

Modifier and Type	Field and Description
static SafeUrl	INNOCUOUS The SafeUrl generated by SafeUrls.sanitize(String) (or portable.builders.SafeUrls) when passed an unsafe URL.
static String	INNOCUOUS_STRING The innocuous string generated by SafeUrls.sanitize(String) (or portable.builders.SafeUrls) when passed an unsafe URL.

Method Summary

Modifier and Type	Method and Description
boolean	equals(Object other)
String	getSafeUrlString() Returns this value's underlying string.
int	hashCode()
String	toString() Returns a debug representation of this value's underlying string, NOT the string representation of the URL.

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Field Detail

INNOCUOUS_STRING

public static final String INNOCUOUS_STRING

The innocuous string generated by SafeUrls.sanitize(String) (or portable.builders.SafeUrls) when passed an unsafe URL. about:invalid is registered in http://www.w3.org/TR/css3-values/#about-invalid. http://tools.ietf.org/html/rfc6694#section-2.1 permits about URLs to contain a fragment, which is not to be considered when determining if an about URL is well-known.

See Also:

Constant Field Values

INNOCUOUS

public static final SafeUrl INNOCUOUS

The SafeUrl generated by SafeUrls.sanitize(String) (or portable.builders.SafeUrls) when passed an unsafe URL. Wraps INNOCUOUS_STRING.

Method Detail

hashCode

public int hashCode()

Overrides:

hashCode in class Object

equals

public boolean equals(Object other)

Overrides:

equals in class Object

toString

public String toString()

Returns a debug representation of this value's underlying string, NOT the string representation of the URL.

Having toString() return a debug representation is intentional. This type has a GWT-compiled JavaScript version; JavaScript has no static typing and a distinct method method name provides a modicum of type-safety.

Overrides:

toString in class Object

See Also:

getSafeUrlString()

getSafeUrlString

public String getSafeUrlString()

Returns this value's underlying string. See class documentation for what guarantees exist on the returned string.